CSRF在ASP.NET Core中的处理方法详解

@Html.AntiFeryToken()

<input name="__RequestVerificationToken" type="hidden" value="CfDJ8FBn4LzSYglJpE6Q0fWvZ8WDMTgwK49lDU1XGuP5-5j4JlSCML_IDOO3XDL5EOyI_mS2Ux7lLSfI7ASQnIIxo2ScEJvnABf9v51TUZl_iM2S63zuiPK4lcXRPa_KUUDbK-LS4HD16pJusFRppj-dEGc" />

public void WriteTo(TextWriter writer, HtmlEncoder encoder)
{
 writer.Write("<input name=\"");
 encoder.Encode(writer, _fieldName);
 writer.Write("\" type=\"hidden\" value=\"");
 encoder.Encode(writer, _requestToken);
 writer.Write("\" />");
}

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]

public class ValidateAntiferyTokenAuthorizationFilter : IAsyncAuthorizationFilter, IAntiferyPolicy
{
 public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
 {
 if (context == null)
 {
 throw new ArgumentNullException(nameof(context));
 }

 if (IsClosestAntiferyPolicy(context.Filters) && ShouldValidate(context))
 {
 try
 {
 await _antifery.ValidateRequestAsync(context.HttpContext);
 }
 catch (AntiferyValidationException exception)
 {
 _logger.AntiferyTokenInvalid(exception.Message, exception);
 context.Result = new BadRequestResult();
 }
 }
 }
}

 services.TryAddSingleton<IAntifery, DefaultAntifery>();

 var tokens = await _tokenStore.GetRequestTokensAsync(httpContext);

public bool TryValidateTokenSet(
 HttpContext httpContext,
 AntiferyToken cookieToken,
 AntiferyToken requestToken,
 out string message)
{
 //去掉了部分非空的判断

 // Do the tokens have the correct format?
 if (!cookieToken.IsCookieToken || requestToken.IsCookieToken)
 {
 message = Resources.AntiferyToken_TokensSwapped;
 return false;
 }

 // Are the security tokens embedded in each ining token identical?
 if (!object.Equals(cookieToken.SecurityToken, requestToken.SecurityToken))
 {
 message = Resources.AntiferyToken_SecurityTokenMismatch;
 return false;
 }

 // Is the ining token meant for the current user?
 var currentUsername = string.Empty;
 BinaryBlob currentClaimUid = null;

 var authenticatedIdentity = GetAuthenticatedIdentity(httpContext.User);
 if (authenticatedIdentity != null)
 {
 currentClaimUid = GetClaimUidBlob(_claimUidExtractor.ExtractClaimUid(httpContext.User));
 if (currentClaimUid == null)
 {
 currentUsername = authenticatedIdentity.Name ?? string.Empty;
 }
 }

 // OpenID and other similar authentication schemes use URIs for the username.
 // These should be treated as case-sensitive.
 var parer = StringComparer.OrdinalIgnoreCase;
 if (currentUsername.StartsWith("http://", StringComparison.OrdinalIgnoreCase) ||
 currentUsername.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
 {
 parer = StringComparer.Ordinal;
 }

 if (!parer.Equals(requestToken.Username, currentUsername))
 {
 message = Resources.FormatAntiferyToken_UsernameMismatch(requestToken.Username, currentUsername);
 return false;
 }

 if (!object.Equals(requestToken.ClaimUid, currentClaimUid))
 {
 message = Resources.AntiferyToken_ClaimUidMismatch;
 return false;
 }

 // Is the AdditionalData valid?
 if (_additionalDataProvider != null &&
 !_additionalDataProvider.ValidateAdditionalData(httpContext, requestToken.AdditionalData))
 {
 message = Resources.AntiferyToken_AdditionalDataCheckFailed;
 return false;
 }

 message = null;
 return true;
}

<form id="form1" action="/home/antiform" method="post">
 @Html.AntiFeryToken()
 <p><input type="text" name="message" /></p>
 <p><input type="submit" value="Send by Form" /></p>
</form>

[ValidateAntiFeryToken]
[HttpPost]
public IActionResult AntiForm(string message)
{
 return Content(message);
}

<form id="form2" action="/home/antiajax" method="post">
 @Html.AntiFeryToken()
 <p><input type="text" name="message" id="ajaxMsg" /></p>
 <p><input type="button" id="btnAjax" value="Send by Ajax" /></p>
</form>

$(function () {
 $("#btnAjax").on("click", function () {
 $("#form2").submit(); 
 });
})

$.ajax({
 type: "post",
 dataType: "html",
 url: '@Url.Action("AntiAjax", "Home")',
 data: { message: $('#ajaxMsg').val() },
 suess: function (result) {
 alert(result);
 },
 error: function (err, sd) {
 alert(err.statusText);
 }
});

$.ajax({
 // 
 data: { message: $('#ajaxMsg').val(), __RequestVerificationToken: $("input[name='__RequestVerificationToken']").val()}
});

$("#btnAjax").on("click", function () {
 var token = $("input[name='__RequestVerificationToken']").val();
 $.ajax({
 type: "post",
 dataType: "html",
 url: '@Url.Action("AntiAjax", "Home")',
 data: { message: $('#ajaxMsg').val() },
 headers:
 {
  "RequestVerificationToken": token
 },
 suess: function (result) {
  alert(result);
 },
 error: function (err, sd) {
  alert(err.statusText);
 }
 });
});

services.AddAntifery(option =>
{
 option.CookieName = "CUSTOMER-CSRF-COOKIE";
 option.FormFieldName = "CustomerFieldName";
 option.HeaderName = "CUSTOMER-CSRF-HEADER";
});

var token = $("input[name='CustomerFieldName']").val();//隐藏域的名称要改
$.ajax({
 type: "post",
 dataType: "html",
 url: '@Url.Action("AntiAjax", "Home")',
 data: { message: $('#ajaxMsg').val() },
 headers:
 {
 "CUSTOMER-CSRF-HEADER": token //注意header要修改
 },
 suess: function (result) {
 alert(result);
 },
 error: function (err, sd) {
 alert(err.statusText);
 }
});